# Integrating SailPoint with LangChain

LangChain is a platform for building, tracing, evaluating, and deploying LLM applications. An organization is the tenant for members, billing, and SSO/SCIM. Work happens in workspaces under that organization. People who sign in, or who are provisioned by SCIM, are organization members - the Platform users this connector aggregates. Each member has one organization role and zero or more workspace memberships, each with one workspace role. Fine-grained permissions such as `projects:read` sit on the role, not on the user. The LangChain connector calls the LangSmith Platform REST API at `https://api.smith.langchain.com` to list members, workspaces, and roles. This document covers how to configure a new direct connection between SailPoint and LangChain for Quick Compliance. For a reference to the terminology specific to SailPoint products, refer to [Source and Connector Definitions](<https://documentation.sailpoint.com/saas/help/sources/index.html#source-and-connector-definitions>).

> [!NOTE]
>
> To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the [SaaS Release Notes](<https://community.sailpoint.com/release-notes/saas>) page.

## Supported Features

The LangChain connector supports the following:

### Account Management

- Aggregate Users

### Entitlement Management

- Aggregate Roles
- Aggregate Workspaces

> [!NOTE]
>
> This connector is read-only. It supports test connection, account aggregation, and entitlement aggregation for Quick Compliance. Provisioning, de-provisioning, and write operations are not supported.

> [!IMPORTANT]
>
> Quick Compliance connectors have the following manual aggregation limits within a 24-hour period:
>
> - **Organization Admins**: Limited to 3 manual account or entitlement aggregations per day per source. This limit is cumulative across all admins in the organization.
> - **Regular Users**: Limited to 1 manual account or entitlement aggregation per day per source.
>
> These limits ensure that individual compliance statuses are kept up to date while maintaining continuous compliance monitoring. If you need to run additional aggregations beyond these limits, contact SailPoint Support.

## Prerequisites

Before you configure the LangChain connector, ensure the following requirements are met:

1. Sign in to [LangChain](<https://www.langchain.com/>).
2. Go to **Settings \> API Keys** and select **\+ API Key**.
3. In the Create an API Key dialog:

   - **Description** - enter a name that identifies the integration, for example `SailPoint`.
   - **Key Type** - select **Personal Access Token**. A PAT authenticates as an individual user and inherits that user's permissions, so the signed-in user must hold the Organization Admin role for the key to read all members, workspaces, and roles.
   - **Default Workspace** - Default Workspace is used only when no X-Tenant-ID header is sent. It does not limit aggregation.
   - **Expiration Date** - choose Never. The key remains valid until it is revoked. If the key is revoked, requests fail with 401; create a new PAT and update API Token.
4. Select **Create API Key** and copy it immediately. LangChain displays the key only once.
5. Record the following values for connector configuration:

   - **Base URL**
   - **API Token**

> [!NOTE]
>
> - The connector authenticates with the PAT sent in the `X-API-Key` header. The organization is implied by the key; you do not configure an Organization ID on the source.
> - All API requests must use HTTPS. Unencrypted HTTP calls are not supported and will fail.
> - Credentials should be stored securely and treated like a password.

## Required Permissions

The connector authenticates with a Personal Access Token. The user who generates the PAT must hold Organization Admin, so that the token can:

- List organization members
- List organization roles
- List workspaces

For more detailed information on LangChain API authentication, refer to the [official LangChain documentation](<https://docs.langchain.com/langsmith/smith-api-ref>).

> [!NOTE]
>
> The linked document is not maintained by SailPoint and is subject to change without notice.